3107 matches found
cv.igrp:igrp-core (>=2.0.0.230625-alpha, <=2.0.0.240307-rc2), cv.igrp:igrp-core-war (>=2.0.0.230625-alpha, <=2.0.0.230801-beta) +91 more potentially affected by CVE-2026-87830 via org.apache.wss4j:wss4j-ws-security-policy-stax (>=3.0.0, <=3.0.5)
org.apache.wss4j:wss4j-ws-security-policy-stax MAVEN version =3.0.0, =2.0.0.230625-alpha, =2.0.0.230625-alpha, =4.0.2, =2.4.0, =4.1.0-tomee-m1, =4.1.0-tomee-m1, =4.1.0-tomee-m1, =4.1.0-tomee-m1, =2.0.0.alpha1, =2.7.0.cr1, =3.8.0, =2.0.0.alpha1, =2.2.4, =2...
cloud.altemista.fwk.framework:cloud-altemistafwk-documentation (3.1.0.release), cloud.altemista.fwk.soap:cloud-altemistafwk-core-soap-wss (>=3.0.0.release, <=3.1.0.release) +280 more potentially affected by CVE-2026-87830 via org.apache.wss4j:wss4j-ws-security-policy-stax (>=2.0.0, <=2.4.3)
org.apache.wss4j:wss4j-ws-security-policy-stax MAVEN version =2.0.0, =3.0.0.release, =3.0.0.release, =3.0.0.release, =3.0.0.release, =1.0.0, =1.2.0, =1.4.0, =4.2.0.1, =1.7.2.230613, =1.7.2.230622, =1.7.3.230802 and more Source cves: CVE-2026-87830 Source advisory: MEND:CVE-2026-87830...
com.codinglair.taf:taf-api-soap (>=1.0.0, <=1.3.0), io.bitbucket.dsmoons:odk-test-framework (>=2.5.1, <=2.5.2) +85 more potentially affected by CVE-2026-87830 via org.apache.wss4j:wss4j-ws-security-policy-stax (>=4.0.0, <=4.0.1)
org.apache.wss4j:wss4j-ws-security-policy-stax MAVEN version =4.0.0, =1.0.0, =2.5.1, =4.2.0-tomee-m0-ce15546, =4.2.0-tomee-m0-ce15546, =4.2.0-tomee-m0-ce15546, =4.2.0-tomee-m0-ce15546, =1.3, =1.3, =1.3, =1.5.0 and more Source cves: CVE-2026-87830 So...
CVE-2026-87830
In the StAX streaming WS-SecurityPolicy validator, certain relative or unsupported XPath expressions can be converted into paths that never match the actual XML element path. A remote SOAP peer may therefore send a required element without the expected signature or encryption. Users are recommend...
CVE-2026-87830
In the StAX streaming WS-SecurityPolicy validator, certain relative or unsupported XPath expressions can be converted into paths that never match the actual XML element path. A remote SOAP peer may therefore send a required element without the expected signature or encryption. Users are recommend...
EUVD-2026-89792
In the StAX streaming WS-SecurityPolicy validator, certain relative or unsupported XPath expressions can be converted into paths that never match the actual XML element path. A remote SOAP peer may therefore send a required element without the expected signature or encryption. Users are recommend...
CVE-2026-87830
The Apache WSS4J library is vulnerable in its StAX streaming WS-SecurityPolicy validator . The root cause is that certain relative or unsupported XPath expressions can be converted into paths that do not match the actual XML element path. This allows a remote SOAP peer to transmit a required elem...
CVE-2026-85532 Apache WSS4J: Insufficient Validation of Derived-Key Parameters
Apache WSS4J accepted attacker-controlled derived-key lengths and offsets without adequate bounds. This could permit cryptographically weak keys or excessive CPU and memory consumption when processing crafted WS-Security messages. The fixes enforce a minimum key length of 16 bytes, a maximum leng...
cloud.altemista.fwk.framework:cloud-altemistafwk-documentation (3.1.0.release), cloud.altemista.fwk.soap:cloud-altemistafwk-core-soap-wss (>=3.0.0.release, <=3.1.0.release) +507 more potentially affected by CVE-2026-85532 via org.apache.wss4j:wss4j-ws-security-common (>=2.0.0, <=2.4.3)
org.apache.wss4j:wss4j-ws-security-common MAVEN version =2.0.0, =3.0.0.release, =3.0.0.release, =3.0.0.release, =3.0.0.release, =1.0.0, =1.0.0, =6.2.12, =2.2.4, =2.2.4, =2.2.4, =4.11.0, =4.11.0, =4.11.0, =4.11.2 and more Source cves: CVE-2026-85532 Source advisory: MEND:CVE-2026-85532...
com.genexus:gamutils (>=4.12.0, <=4.14.5), com.genexus:gxawsserverless (>=4.12.0, <=4.14.5) +199 more potentially affected by CVE-2026-85532 via org.apache.wss4j:wss4j-ws-security-common (>=3.0.0, <=3.0.5)
org.apache.wss4j:wss4j-ws-security-common MAVEN version =3.0.0, =4.12.0, =4.12.0, =4.12.0, =4.12.0, =4.12.0, =4.12.0, =4.12.0, =4.12.0, =4.12.0, =4.12.0, =4.12.0, =4.12.0, =4.12.0, =4.12.0, =4.12.0, =4.14.5 and more Source cves: CVE-2026-85532 Source advisory: MEND:CVE-2026-85532...
com.axonivy.ivy.tool.soap:cxf-client-codegen (2.0.0), com.codinglair.taf:taf-api-soap (>=1.0.0, <=1.3.0) +156 more potentially affected by CVE-2026-85532 via org.apache.wss4j:wss4j-ws-security-common (>=4.0.0, <=4.0.1)
org.apache.wss4j:wss4j-ws-security-common MAVEN version =4.0.0, =1.0.0, =0.9.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.4.0, =4.0.0, =4.0.0, =4.0.0, =4.0.2, =4.0.2, =4.7.0 and more Source cves: CVE-2026-85532 Source advisory: MEND:CVE-2026-85532...
CVE-2026-85532
Apache WSS4J accepted attacker-controlled derived-key lengths and offsets without adequate bounds. This could permit cryptographically weak keys or excessive CPU and memory consumption when processing crafted WS-Security messages. The fixes enforce a minimum key length of 16 bytes, a maximum leng...
cloud.altemista.fwk.framework:cloud-altemistafwk-documentation (3.1.0.release), cloud.altemista.fwk.soap:cloud-altemistafwk-core-soap-wss (>=3.0.0.release, <=3.1.0.release) +281 more potentially affected by CVE-2026-85532 via org.apache.wss4j:wss4j-ws-security-stax (>=2.0.0, <=2.4.3)
org.apache.wss4j:wss4j-ws-security-stax MAVEN version =2.0.0, =3.0.0.release, =3.0.0.release, =3.0.0.release, =3.0.0.release, =1.0.0, =1.2.0, =1.4.0, =4.2.0.1, =1.7.2.230613, =1.7.2.230622, =1.7.3.230802 and more Source cves: CVE-2026-85532 Source advisory: MEND:CVE-2026-85532...
cv.igrp:igrp-core (>=2.0.0.230625-alpha, <=2.0.0.240307-rc2), cv.igrp:igrp-core-war (>=2.0.0.230625-alpha, <=2.0.0.230801-beta) +93 more potentially affected by CVE-2026-85532 via org.apache.wss4j:wss4j-ws-security-stax (>=3.0.0, <=3.0.5)
org.apache.wss4j:wss4j-ws-security-stax MAVEN version =3.0.0, =2.0.0.230625-alpha, =2.0.0.230625-alpha, =4.0.2, =2.4.0, =4.1.0-tomee-m1, =4.1.0-tomee-m1, =4.1.0-tomee-m1, =4.1.0-tomee-m1, =2.0.0.alpha1, =2.7.0.cr1, =3.8.0, =2.0.0.alpha1, =2.2.4, =2.0.0.alpha1,...
com.codinglair.taf:taf-api-soap (>=1.0.0, <=1.3.0), io.bitbucket.dsmoons:odk-test-framework (>=2.5.1, <=2.5.2) +86 more potentially affected by CVE-2026-85532 via org.apache.wss4j:wss4j-ws-security-stax (>=4.0.0, <=4.0.1)
org.apache.wss4j:wss4j-ws-security-stax MAVEN version =4.0.0, =1.0.0, =2.5.1, =4.2.0-tomee-m0-ce15546, =4.2.0-tomee-m0-ce15546, =4.2.0-tomee-m0-ce15546, =4.2.0-tomee-m0-ce15546, =1.3, =1.3, =1.3, =1.5.0 and more Source cves: CVE-2026-85532 Source advisory:...
EUVD-2026-89791
Apache WSS4J accepted attacker-controlled derived-key lengths and offsets without adequate bounds. This could permit cryptographically weak keys or excessive CPU and memory consumption when processing crafted WS-Security messages. The fixes enforce a minimum key length of 16 bytes, a maximum leng...
CVE-2026-87830: Improper Neutralization of Special Elements used in an Expression Language Statement
In the StAX streaming WS-SecurityPolicy validator, certain relative or unsupported XPath expressions can be converted into paths that never match the actual XML element path. A remote SOAP peer may therefore send a required element without the expected signature or encryption. Users are recommend...
PT-2026-103133
In the WSS4J streaming StAX code, a signature reference using the WS-Security STR-Transform leaves an internal "inside signed content" flag permanently set. The WS-SecurityPolicy enforcer uses that flag to decide whether an element needs checking, so it stops evaluating SignedParts and...
PT-2026-103130
In the StAX streaming WS-SecurityPolicy validator, certain relative or unsupported XPath expressions can be converted into paths that never match the actual XML element path. A remote SOAP peer may therefore send a required element without the expected signature or encryption. Users are recommend...